Building using an image from a private repository results in "x509: certificate signed by unknown authority".

[chriseaton]

When our docker file specifies an image in a private repo, it causes the oci-build-task to fail. As far I could tell there's no way to specify a custom CA.

ERROR: failed to do request: Head "https://our-private-repo/v2/shared/centos/manifests/latest": x509: certificate signed by unknown authority

[CJLove]

Here's a possible workaround, with the downside that you're basically forking the official oci-build-task image and using it in the interim:

1. Build your own oci-build-task image with a Dockerfile like this to add your ca.crt file to the image, and push to your private registry

FROM docker.io/concourse/oci-build-task:latest

COPY ca.crt /usr/local/share/ca-certificates/

RUN update-ca-certificates

2. In your pipeline specify your oci-build-task image in place of the official one

...
  - task: build-task-image
    privileged: true
    config:
      platform: linux
      image_resource:
        type: registry-image
        source:
          repository: fir.love.io:3005/amd64/oci-build-task
          # repository: concourse/oci-build-task
          tag: latest
...

[lrstanley]

Related, that has a bit cleaner temporary solution that doesn't require making a custom image: https://github.com/concourse/oci-build-task/issues/70#issuecomment-933674965

Looking at the code, however, I believe adding an input for custom certs/ca should be pretty easy.